[VulnWatch] Snitz Forum 3.3.03 Remote Command Execution

sharpiemarker_at_hushmail.com
Date: 05/12/03

  • Next message: Peter Winter-Smith: "[VulnWatch] Vulnerability in ' poster version.two'" 
    Date: Mon, 12 May 2003 08:47:38 -0700
To: vulnwatch@vulnwatch.org

    [Moderator: This was inadvertently sent to "VulnDiscuss" instead of "VulnWatch"
    over the weekend.]

    Overview:
    Snitz Forums 2000, one of the best ASP based bulletin board systems on
    the market. Getting better every day! A complete board system (forum)
    that allows the user access to a friendly and intuitive interface.
    http://forum.snitz.com

    Problem Description:
    Snitz Forums 3.3.03 has an SQL injection vulnerability in its "register.asp"
    page with its "Email" variable. Because "register.asp" doesn't check
    user input, remote users can execute stored procedures (such as "xp_cmdshell")
    to arbitrarily run non-interactive commands on the system.

    Vendor Notification:
    Vendor notified last month. This is a deprecated version and users should
    upgrade immediately.

    Versions Affected:
    3.3.03
    Most likely earlier versions (not tested)

    Fix:
    Upgrade to 3.4.03, the latest version.

    Exploit:
    See attached proof-of-concept Perl exploit.

    Concerned about your privacy? Follow this link to get
    FREE encrypted email: https://www.hushmail.com/?l=2

    Free, ultra-private instant messaging with Hush Messenger
    https://www.hushmail.com/services.php?subloc=messenger&l=434

    Big $$$ to be made with the HushMail Affiliate Program:
    https://www.hushmail.com/about.php?subloc=affiliate&l=427

  • Next message: Peter Winter-Smith: "[VulnWatch] Vulnerability in ' poster version.two'"
    • Quantcast